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REVIEW OF HYDROGEN ACCIDENTS AND INCIDENTS IN NASA OPERATIONS 

by Paul M. Or din 
Lewis Research Center 


ABSTRACT 

The report reviews a number of the accidents/ incidents with hydrogen 
in NASA operations. The cause factors for the mishaps ara r * vieW ® d * n f 
show that^although few accidents occurred, the number could have be 
rher reduced if the established NASA rules and regulations had been rol- 
lowed. Requirements for effective safety codes and areas ° f ® bud ? *° 
hydrogen safety information are included. The report concludes wi 
compilation of 96 hydrogen mishaps; a description of the accidents and 

their causes. 


INTRODUCTION 

The national concern over the growing energy crisis and environmental 
pollution has resulted in the consideration of hydrogen as a ® ui * ab ?-® 
for future use. Hydrogen is readily produced from water by electrolys , 
and designs have been proposed in which nuclear and solar power s y®- em 
would provide the energy for producing the hydrogen efficiently. One ad - 
van t a gtT of us ing hydrogen is increased efficiencies in energy conversion 
devices over those obtained with hydrocarbon fuels. 

Studies have shown that it is possible to produce liquid hydrogen at 
costs that would be competitive with those of other fuels. However the 
availability and economics of a large liquid hydrogen supply are still a 
vlry important factor in the overall concept of a hydrogen economy. The 
second major factor in the development of a hydrogen economy is safety, 
^t arethe safety problems in the production, handling, transportation, 
!nd use of liquid and gaseous hydrogen? The purpose of this paper is to 
provide inf oration on the overall safety cl hydrogen by reviewing records 
of accidents and incidents which have occurred in the development and op- 
eration of NASA's propulsion and power systems. 

This compilation of 96 mishaps serves not only to provide a 
concept of the possible hazards in the handling end use of ^cg-n but 
identifies significant lessons learned from these experiences. T - 
records reviewed were primarily from NASA centers. These records de- 
scribed the mishaps and their causes and in many instances included recom- 
mended preventive or corrective actions- A number were obtained from co - 
tractors involved in the development of the chemical and nuclear propul- 
sion systems. 

Areas of research ,md development are suggested for increased safety 
and for the development of techniques to reduce the consequences of any 

mishaps . 


2 


NASA OPERATIONS 

Hydrogen is used principally as a propellant for propulsion. The 
Centaur stage and the second and third stages of the Saturn launch 
vehicle utilize the liquid hydrogen - liquid oxygen propellant combina- 
tion. The fuel-tank capacity of the Centaur stage is 38 cubic meters 
(10 000 gal). The Saturn's first stage has a 1021 cubic meter 
(270 000 gal) capacity and the second stage a 276 cubic-meter (73 000 gal) 
capacity. 

Large quantities of liquid hydrogen are stored and used at NASA and- 
contractor facilities. Tanks with storage capacities of over 3213 cubic 
meters (850 000 gal) exist at the Kennedy Space Center (KSC) . Approxi- 
mately 7600 cubic meters (2 million gal) of liquid hydrogen storage was 
available at the nuclear rocket test facility. Liquid hydrogen is trans- 
ported from the manufacturer to the various NASA and contractor facili- 
ties in over-the-road tanker trailers designed to contain from 11 to 
61 cubic meters (3000 to 16 000 gal) and in railroad cars having a maxi- 
mum capacity of 129 cubic meters (34 000 gal) . Each tcr.ker trailer for 
the transportation of liquid hydrogen requires a special permit from the 
Department of Transportation (DOT). The Code of Federal Regulations in- 
cludes the detailed requirements for railroad transportation. 

In the Apollo-Saturn program alone, the KSC tanker trailers hauled 
over 16 million gallons of liquid hydrogen. Liquid hydrogen was also 
transported by barge to the Mississippi Test Facility. These barges have 
a capacity of 950 cubic meters (250 000 gal) and use vacuum perlite insu- 
lation to keep the boiloff below 0.15 percent per day. Liquid hydrogen 
was transferred from the barges to the te3t vehicle tanks or storage 
tanks at rates of about 38 m*/min (10 000 gal/min) through 25 .4 -centimeter 
(10-in.) diameter vacuum-jacketed lines. The barge operations were con- 
ducted in special canals in which the level changes of a barge during 
loading and unloading were controlled, as well as in canals which wo=re 
subjected to tidal conditions. 

The experience with hydrogen in NASA and AEC operations has been ex- 
tremely gratifying in that relatively few accidents have occurred. We 
attribute this to comprehensive cryogenic and hydrogen safety programs 
practiced at the various facilities. For the most part, mishaps occurred 
when the guidelines and prescribed procedures included in the safety pro- 
grams were neglected. 


CAUSES OF MISHAPS 

The causal factors which contributed to the mishaps detailed in the 
appendix have been categorised as follow: 

O) Procedural deficie ncies : the failure to follow established pro- 

cedures or to prepare proper procedures 

(2) Planning deficiencies : limited planning, such as failures to 

prepare test plans - o» to perform hazard studies 
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m iwten deficiencies: inadequate component or system designs, 

* - ? ffiL f, 4 i„ re t o~ s pecify safety devices and omission of other 

and specifications) 

jsaass.'syajsgr 

aid thf uck of training and/or spacifio inatroctlona 

(6) Mai function : any anomaly, including components in the system 

which failed to function as intended 

(7) Materials incompatibility: incompatible materials either brought 

together by accident or designed into the system 

(8) Contamination : the use of contaminated material 

The distribution of the mishaps according to these several categories 

as being responsible for the mishap. 

The largest number of mishaps (26 petcant ) ™ s . c »” s ““^o^ted for 
caused by work area deficiencies, Procedur oercent Plan- 

26 percent . Design d^clenciaa £££%££ f^ca^gorUs. 

ning deficiencies followed next with is percent. Qf 

which are basic to an overview of sa ety ** q £ ercent of the mis haps re- 
engineering system, were responsible p g ercent Q f the accidents, 

;&o£r~^ — 

bilities were each factors in about 3 percent of the mist.ap . 

An effort was made to identity the 
action directly responsible for each accident These results 

in figure 2. 

Valv. inunctions 

« «u .s p rn:«b.t of 

clenclas^'^For^xample, valva malfunction and .alva laaks war. caused by 

(1) Not following the established procedure in applying correct 
pressures 

(2) Not carrying out the purging procedures as prescribed in the 
operational requirements 
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(3) Not opening or closing the proper valves in the system as indi- 
cated in the design specifications 

On several occasions, the valve design or the materials used in construc- 
tion caused the malfunction or leak. Leaking connections and/or fittings 
were identified as being separate from valve leaks and caused about 
16 percent of the mishaps. Items such as loose flange connections caused 
shrinkage of the "0" rings and/or gaskets because of the low temperature 
and resulted in leaks that caused mishaps. Fittings not installed prop- 
erly also resulted in leaks that caused accidents. To a large extent, 
not following established procedures, or the lack of specific instruc- 
tions were responsible for the leaking connections. 

Safety disk failures, materials failures, and high venting rates 
were each identified as responsible for about 11 percent of the mishaps. 
Safety disk failures in tank and piping installations and in over-t'ne- 
road tanker trailers caused leaks which were responsible for some of the 
accidents. A number of the disk failures were considered as malfunctions; 
however, in several instances, improper installation and failure to fol- 
low established planning for the replacement of ruptured disks caused the 
failure. In most instances, the disk performed as designed and ruptured 
when the design pressure was attained. The rupture did, however, release 
hydrogen and, in some instances, caused an accident. 

Liquid hydrogen can decrease the ductility and impact resistance of 
structural materials with which it comes in contact. The use of materials 
not compatible with hydrogen caused a number of mishaps. In some in- 
stances the design did not fully consider the wide range of coefficients 
of expansion of the materials used and the degree of confinement of these 
materials required to limit the development of high stresses. Hydrogen 
embrittlement of materials was also a factor in a number of the accidents. 

High venting rates of hydrogen through venting systems were consid- 
ered as being responsible for a number of the mishaps. The problem re- 
lated to these high venting rates, which to a large extent were due to 
system design limitations, was the ignition of hydrogen-air mixtures. It 
appears that, with high venting rates, ignition tends to occur more fre- 
quently above the vent stack, around the vehicle stage platform area, or 
above the tank testing area. High venting rates during weather condi- 
tions which limited the dispersion of hydrogen appear to be responsible 
for providing easily ignitible hydrogen-air mixtures. 

Ctyopumping has been identified as being involved in about 10 per- 
cent of the mishaps. In a number of instances, the cooling of vessels 
and lines produced a reduced-prc3sure environment that resulted in air 
being sucked into the system. Air entered through leaks or faulty valves. 
Incomplete facility construction and unsatisfactory procedures also al- 
lowed air to enter the system* The air formed flammable mixtures with 
hydrogen and occasionally Igniteo or, in several Instances, liquefied (or 
solidified) and formed flammable hydrogen-air mixtures during the warmup 
phase of the operations. The Ignition cf surh mixtures under these con- 
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ditions usually resulted In explosions or detonations. Mishaps caused by 
the liquefaction of air were also included in the cryopumping category. 

Air liquefies and forms a running stream when directly exposed to tanks 
and piping containing liquid hydrogen. In a number of tests, the liquid 
air was not directed away from major pieces of equipment and caused some 
failures that resulted in hydrogen leaks and fires. 

The mishaps attributed to air in the system caused about 5 percent 
of the accidents. These included mishaps in which work with hydrogen was 
initiated or repairs were performed in hydrogen systems without the sys- 
tem or equipment being properly purged. The flammable hydrogen-air mix- 
tures within the system components, such as tanks and lines, usually ex- 
ploded when an ignition source was available. In a number of such in- 
stances, drilling, cutting, or welding operations provided the ignition 
source. Also included in figure 2 are bellows failures „ which usually 
occurred in liquid hydrogen lines. The release of hydrogen most fre- 
quently resulted in fires. System overpressurization and Installation 
errors were responsible for a large number of the. bellows ruptures, which 
resulted in 4 percent of the mishaps. Several of the accidents were 
caused by battery operations (about 4 percent) in which hydrogen-air mix- 
tures formed and ignited. In general, the lack of purging or ventilation 
was responsible for the buildup of the flammable mixtures. Highway acci- 
dents accounted for about 4 percent of the total mishaps included in the 
appendix. The other identified causes, which each resulted in less than 
3 percent of the mishaps, included tank and line ruptures and vacuum 
losses. 

In a number of accidents, the released hydrogen did not ignite. 

Table I presents a summary of the results of the mishaps with respect to 
where the release occurred and whether the hydrogen-air mixtures ignited. 

A total of 80 (83 percent) of the mishaps involved a release of liquid and/or 
gaseous hydrogen. The hydrogen was considered as being released to the 
atmosphere or within an enclosure such as a tank or line. In general, 
when the hydrogen was released within an enclosure, the enclosure con- 
tained aa air environment, and a hydrogen-air flammable mixture resulted 
immediately. About 69 percent of the mishaps (56) involved a release of 
hydrogen to the atmosphere, and 21 percent involved release to enclosures. 

In six mishaps, hydrogen was considered as being released to both loca- 
tions . 

When hydrogen was released to the atmoephere, ignition of the mix- 
ture occurred 62 percent of the time (41 mishaps); and for release to en- 
closures, Ignition occurred each time (20 mishaps). The available acci- 
dent reports were reviewed to determine the source of ignition, and the 
results are shown in figure 3. In 30 percent of the mishaps in which 
hydrogen was released and ignition occurred, the source of ignition was 
not known. Electric short circuits and sparking were considered to be 
responsible for 24 percent of the ignitions and static charges for about 
17 percent. For about 7 percent of the releases, the source of ignition 
was believed to be the flare on the vent stack. Use of welding or cut- 
ting torches, metal fracture, and impingement of hf gh-velocity gases were 
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each considered to be responsible for about 5 percent of the ignitions. 
Ignition of hydrogen-air mixtures attributed to metal fracture involved 
tensile testing mishaps in which the fracturing of the specimens provided 
the ignition source. Also included are mishaps in which the cause of ig- 
nition was considered to be burst safety disks or metal failures. The 
specific ignition source was probably the static charges or hot spots 
that developed during material rupture. Ignitions attributed to impact 
include those considered to be caused by high-velocity fragments. 

The importance of satisfactorily purging a system before any opera- 
tions with hydrogen is demonstrated by the data presented in table II. 

The mishaps were reviewed with respect to the release of hydrogen, the 
ignition of the hydrogen-air mixture, and the role of possible purging 
problems. Of the total number of mishaps (96) 25 percent were associated 
with a purging problem j that is, the system was not purged as prescribed 
nor was the exit gas analyzed to ensure the removal of air . Such purging 
problems resulted in the release of hydrogen to the atmosphere (14 acci- 
dents (58 percent)) and in release within the system (10 accidents 
(42 percent)). Of those mishaps involving a release of hydrogen to the 
atmosphere, 93 percent resulted in ignition. Ignition occurred for all 
those mishaps in which hydrogen was released into the system. Various 
purging procedures are recommended and operational methods defined, but 
it appears that more positive means must be made available to ensure com- 
pliance with the requirements. 

The causes of hydrogen tanker trailer mishaps are summarized in fig- 
ure 4. Seventeen tanker trailer mishaps were included in the study with 
71 percent (12) associated with off-loading operations (usually at the 
test facility) and 29 percent (5) occurring on the highway. In about 
92 percent of the off-loading accidents (11), hydrogen was released, but 
in only 27 percent (3) did ignition take place. With respect to highway 
mishaps, 60 percent (3) involved a release of hydrogen, but no ignitions 
occurred. For both the off-loading and highway mishaps, disk rupture was 
the principal cause; other causes included open or leaking safety valves 
(18 percent), loose couplings, vacuum failures, and vent valve leaks. In 
several instances, positioning the trailer in preparation for connecting 
lines resulted in the driver hitting parts of the facility. 

The safety record of cver-the-road transportation of liquid hydrogen 
is quite evident in that only five tanker trailer highway accidents aire 
included. These reports involved NASA operations. In three of these ac- 
cidents the tractor was heavily damaged, but the trailer remained sub- 
stantially sound. There was no damage in the other two highway accidsnts. 
In only one case was liquid hydrogen spilled on the ground, and there was 
no ignition of the hydrogen-air mixture. 

The results of this review indicate relatively few accidents inv jiv- 
ing hydrogen during the development and operation of the NASA propulsion 
systems. This number could have been reduced considerably if the estab- 
lished rules and regulations had been carefully followed. Comprehensive 
hydrogen safety programs, including detailed safety codes, must be 
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evolved for each system. As with the NASA guidelines, these safety and 
operational codes must be based on the following factors: 

(1) Knowledge of the potential hazards of hydrogen 

(2) System engineering to preclude hazards 

(3) Personnel education in. both the potential hazards and technical 
knowledge of the system 

(4) Assurance that specific safety procedures exist and are followed 
for each operation 

These factors demand that, to be effective, safety codes must be 
based on knowledge of the properties of both the fluids (liquid gases and 
mixtures) and the materials used to confine them. The systems safety con- 
cept requires a technical management discipline covering conceptual and 
design studies, engineering, testing, fabrication, and operation of each 
system. At lease one level of fail-safe redundancy should be provided 
for all subsystems and components judged to be critical or catastrophic. 

It is important that all supervisory and technical personnel working on a 
system have an intimate knowledge of the equipment arrangement, facili- 
ties, and system operations. Strict discipline must be maintained 
throughout all phases of testing, and procedures regulating each step of 
the operation are mandatory. 


CONCLUDING REMARKS 

Since many of the accident reports on which this review was based 
did not contain sufficiently detailed technical descriptions of the mis- 
haps or were not specific as to the hardware and/or operating procedures 
involved, efforts are underway to modify the reporting procedures to in- 
clude such information. The records do, however, indicate a very high 
level of safety with hydrogen. The solution to many of the problems can 
positively be prescribed, but further research and development would be 
required for answers to others. Some of those areas in which studies 
should be performed Include the following: 

(1) Means to ensure positive removal of air during purging 

(2) Studies of maximum possible disposal rates and how these rates 
would be modified by the existing weather conditions 

(3) Development of easy and rapid means of detecting any initiation 
of eryopumping which could promote hydrogen-air mixture 

(4) Development of standards and specifications for liquid hydrogen 
valves, fittings, and connections with respect to leakage re- 
quirements 
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(5) An improved understanding of the possible sources of ignition of 
the hydrogen-air mixture and means for eliminating t em 

(6) The development of highway driving guidelines with respect to 
road and environmental conditions 

(7) Means of limiting flammable mixtures such as 

points, adequate ventilation, inerting systems, and installing 
monitoring devices around suspected leak points 
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Figure 2 . - Detail distribution of causes of mishaps In which hydrogen was re- 
leased (more than one cause factor is involved with some mishaps). 
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Figure 3. - Ignition sources - mishaps involv- 
ing release of hydrogen. 


LIQUID HYDROGEN TRAILER ACCIDENTS 
TOTAL NUMBER, 17 

OFF LOADING LOCATION, 12 (71 PERCENT) 
ACCIDENTS IN WHICH H 2 WAS RELEASED: 
OFF LOADING, 11 (92 PERCENT): HIGHWAY, 
3(60) 

ACCIDENTS IN WHICH H 2 IGNITED: 

OFF LOADING, 3 (27 PERCENT); HIGHWAY, 0 



Figure 4. - Liquid hydrogen trailer accidents. 
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53. During transfer of water from a storage tank, 53. The technician was wearing a nylon jacket 
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a separate facility after which work on the 
header was continued. In striking an arc for 
welding, ignition of H2 gas exiting from the 
hole in the header resulted. 
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